```html
<!DOCTYPE html>
<html lang="zh-CN">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Nginx访问控制列表(ACL)配置指南</title>
    <link href="https://cdn.staticfile.org/font-awesome/6.4.0/css/all.min.css" rel="stylesheet">
    <link href="https://cdn.staticfile.org/tailwindcss/2.2.19/tailwind.min.css" rel="stylesheet">
    <link href="https://fonts.googleapis.com/css2?family=Noto+Serif+SC:wght@400;500;600;700&family=NotoSans+SC:wght@300;400;500;700&display=swap" rel="stylesheet">
    <script src="https://cdn.jsdelivr.net/npm/mermaid@latest/dist/mermaid.min.js"></script>
    <style>
        body {
            font-family: 'Noto Sans SC', Tahoma, Arial, Roboto, "Droid Sans", "Helvetica Neue", "Droid Sans Fallback", "Heiti SC", "Hiragino Sans GB", Simsun, sans-serif;
            background-color: #f8fafc;
            color: #1e293b;
            line-height: 1.6;
        }
        .hero {
            background: linear-gradient(135deg, #1e3a8a 0%, #1e40af 100%);
        }
        .code-block {
            background-color: #1e293b;
            border-radius: 0.5rem;
            box-shadow: 0 4px 6px -1px rgba(0, 0, 0, 0.1), 0 2px 4px -1px rgba(0, 0, 0, 0.06);
        }
        .code-block pre {
            margin: 0;
            padding: 1.25rem;
            overflow-x: auto;
        }
        .code-block code {
            font-family: 'Courier New', Courier, monospace;
            color: #e2e8f0;
            font-size: 0.875rem;
            line-height: 1.5;
        }
        .card {
            transition: all 0.3s ease;
            border-radius: 0.5rem;
            overflow: hidden;
            box-shadow: 0 1px 3px 0 rgba(0, 0, 0, 0.1), 0 1px 2px 0 rgba(0, 0, 0, 0.06);
        }
        .card:hover {
            transform: translateY(-5px);
            box-shadow: 0 10px 15px -3px rgba(0, 0, 0, 0.1), 0 4px 6px -2px rgba(0, 0, 0, 0.05);
        }
        .highlight {
            background: linear-gradient(120deg, #60a5fa 0%, #3b82f6 100%);
            background-repeat: no-repeat;
            background-size: 100% 40%;
            background-position: 0 88%;
        }
    </style>
</head>
<body>
    <!-- Hero Section -->
    <section class="hero text-white py-20 px-4 md:py-28">
        <div class="container mx-auto max-w-6xl">
            <div class="flex flex-col items-center text-center">
                <h1 class="text-4xl md:text-5xl font-bold mb-4 font-serif">Nginx <span class="highlight">访问控制列表</span> 配置指南</h1>
                <p class="text-xl md:text-2xl opacity-90 mb-8 max-w-3xl">通过精细的IP访问控制，增强您的服务器安全性</p>
                <div class="flex space-x-4">
                    <button class="bg-white text-blue-800 px-6 py-3 rounded-full font-medium hover:bg-blue-50 transition duration-300 flex items-center">
                        <i class="fas fa-book mr-2"></i> 学习更多
                    </button>
                    <button class="border border-white text-white px-6 py-3 rounded-full font-medium hover:bg-white hover:text-blue-800 transition duration-300 flex items-center">
                        <i class="fas fa-code mr-2"></i> 查看示例
                    </button>
                </div>
            </div>
        </div>
    </section>

    <!-- Main Content -->
    <main class="container mx-auto max-w-6xl px-4 py-12">
        <!-- Introduction -->
        <section class="mb-16">
            <div class="bg-white rounded-xl shadow-md p-6 md:p-8">
                <h2 class="text-2xl md:text-3xl font-bold mb-4 font-serif">什么是Nginx访问控制列表(ACL)?</h2>
                <p class="text-lg mb-6">访问控制列表(ACL)是Nginx中用于限制客户端访问服务器或特定资源的重要安全功能。它通过<code class="bg-blue-100 text-blue-800 px-2 py-1 rounded">allow</code>和<code class="bg-blue-100 text-blue-800 px-2 py-1 rounded">deny</code>指令，基于IP地址或其他条件来控制访问权限。</p>
                
                <div class="mt-8">
                    <div class="mermaid">
                        graph TD
                            A[客户端请求] --> B{IP地址检查}
                            B -->|匹配allow规则| C[允许访问]
                            B -->|不匹配| D[拒绝访问]
                    </div>
                </div>
            </div>
        </section>

        <!-- Basic Configuration -->
        <section class="mb-16">
            <div class="flex items-center mb-6">
                <div class="bg-blue-600 w-2 h-8 rounded-full mr-4"></div>
                <h2 class="text-2xl font-bold font-serif">基础配置</h2>
            </div>

            <!-- Card 1 -->
            <div class="grid md:grid-cols-2 gap-8 mb-8">
                <div class="card bg-white">
                    <div class="p-6">
                        <div class="flex items-center mb-4">
                            <div class="bg-blue-100 text-blue-800 p-2 rounded-full mr-3">
                                <i class="fas fa-lock"></i>
                            </div>
                            <h3 class="text-xl font-bold">允许和拒绝IP地址</h3>
                        </div>
                        <p class="text-gray-600 mb-4">最基本的ACL配置，指定允许或拒绝特定IP地址访问。</p>
                        
                        <div class="code-block">
                            <pre><code>server {
    listen 80;
    server_name demo.com;

    location / {
        # 允许特定 IP 访问
        allow 192.168.1.1;
        allow 192.168.1.0/24;

        # 拒绝其他 IP 访问
        deny all;

        # 其他配置
        root /usr/share/nginx/html;
        index index.html;
    }
}</code></pre>
                        </div>
                    </div>
                </div>

                <!-- Card 2 -->
                <div class="card bg-white">
                    <div class="p-6">
                        <div class="flex items-center mb-4">
                            <div class="bg-blue-100 text-blue-800 p-2 rounded-full mr-3">
                                <i class="fas fa-network-wired"></i>
                            </div>
                            <h3 class="text-xl font-bold">多个IP和网络控制</h3>
                        </div>
                        <p class="text-gray-600 mb-4">可以同时配置多个IP地址和网络段的访问权限。</p>
                        
                        <div class="code-block">
                            <pre><code>server {
    listen 80;
    server_name demo.com;

    location / {
        # 允许指定的 IP 地址和网络访问
        allow 192.168.1.100;
        allow 10.0.0.0/8;

        # 拒绝所有其他 IP 地址
        deny all;

        # 其他配置
        root /usr/share/nginx/html;
        index index.html;
    }
}</code></pre>
                        </div>
                    </div>
                </div>
            </div>

            <!-- Card 3 -->
            <div class="card bg-white max-w-3xl mx-auto">
                <div class="p-6">
                    <div class="flex items-center mb-4">
                        <div class="bg-blue-100 text-blue-800 p-2 rounded-full mr-3">
                            <i class="fas fa-folder-open"></i>
                        </div>
                        <h3 class="text-xl font-bold">特定路径访问控制</h3>
                    </div>
                    <p class="text-gray-600 mb-4">可以为不同的路径设置不同的访问规则，如限制管理后台的访问。</p>
                    
                    <div class="code-block">
                        <pre><code>server {
    listen 80;
    server_name demo.com;

    location /admin {
        # 允许指定的 IP 地址访问 /admin 路径
        allow 192.168.1.0/24;

        # 拒绝其他 IP 地址访问 /admin 路径
        deny all;

        # 其他配置
        root /usr/share/nginx/html;
        index index.html;
    }
}</code></pre>
                    </div>
                </div>
            </div>
        </section>

        <!-- Advanced Configuration -->
        <section class="mb-16">
            <div class="flex items-center mb-6">
                <div class="bg-purple-600 w-2 h-8 rounded-full mr-4"></div>
                <h2 class="text-2xl font-bold font-serif">高级配置</h2>
            </div>

            <!-- Card 1 -->
            <div class="grid md:grid-cols-2 gap-8">
                <div class="card bg-white">
                    <div class="p-6">
                        <div class="flex items-center mb-4">
                            <div class="bg-purple-100 text-purple-800 p-2 rounded-full mr-3">
                                <i class="fas fa-globe"></i>
                            </div>
                            <h3 class="text-xl font-bold">使用geo模块动态控制</h3>
                        </div>
                        <p class="text-gray-600 mb-4">利用Nginx的geo模块实现更灵活的动态访问控制。</p>
                        
                        <div class="code-block">
                            <pre><code>geo $block_ip {
    default 0;
    192.168.1.1 1;
    10.0.0.0/8 1;
}

server {
    listen 80;
    server_name demo.com;

    location / {
        if ($block_ip) {
            return 403;
        }

        # 其他配置
        root /usr/share/nginx/html;
        index index.html;
    }
}</code></pre>
                        </div>
                    </div>
                </div>

                <!-- Card 2 -->
                <div class="card bg-white">
                    <div class="p-6">
                        <div class="flex items-center mb-4">
                            <div class="bg-purple-100 text-purple-800 p-2 rounded-full mr-3">
                                <i class="fas fa-file-code"></i>
                            </div>
                            <h3 class="text-xl font-bold">include指令管理ACL</h3>
                        </div>
                        <p class="text-gray-600 mb-4">将大量IP地址规则分离到单独文件中，提高可维护性。</p>
                        
                        <div class="code-block">
                            <pre><code># 在主配置文件中
server {
    listen 80;
    server_name demo.com;

    location / {
        include /etc/nginx/allowlist.conf;
        include /etc/nginx/denylist.conf;

        # 其他配置
        root /usr/share/nginx/html;
        index index.html;
    }
}

# allowlist.conf 文件内容
allow 192.168.1.1;
allow 192.168.1.0/24;

# denylist.conf 文件内容
deny 10.0.0.0/8;
deny all;</code></pre>
                        </div>
                    </div>
                </div>
            </div>
        </section>

        <!-- Best Practices -->
        <section class="mb-16">
            <div class="bg-gradient-to-r from-blue-50 to-purple-50 rounded-xl p-8">
                <div class="flex items-center mb-6">
                    <div class="bg-blue-600 w-2 h-8 rounded-full mr-4"></div>
                    <h2 class="text-2xl font-bold font-serif">最佳实践与注意事项</h2>
                </div>

                <div class="grid md:grid-cols-2 gap-6">
                    <div class="bg-white rounded-lg p-6 shadow-sm">
                        <div class="flex items-start mb-3">
                            <div class="bg-green-100 text-green-800 p-2 rounded-full mr-3 flex-shrink-0">
                                <i class="fas fa-check-circle"></i>
                            </div>
                            <div>
                                <h3 class="font-bold text-lg mb-2">规则顺序很重要</h3>
                                <p class="text-gray-600">Nginx按顺序处理allow/deny指令，第一个匹配的规则会决定访问权限。通常应该先放具体规则，最后放通用规则。</p>
                            </div>
                        </div>
                    </div>

                    <div class="bg-white rounded-lg p-6 shadow-sm">
                        <div class="flex items-start mb-3">
                            <div class="bg-yellow-100 text-yellow-800 p-2 rounded-full mr-3 flex-shrink-0">
                                <i class="fas fa-exclamation-triangle"></i>
                            </div>
                            <div>
                                <h3 class="font-bold text-lg mb-2">避免过度限制</h3>
                                <p class="text-gray-600">确保不要意外锁定自己或合法用户。测试新规则时，保持另一个SSH会话开放以便回滚配置。</p>
                            </div>
                        </div>
                    </div>

                    <div class="bg-white rounded-lg p-6 shadow-sm">
                        <div class="flex items-start mb-3">
                            <div class="bg-blue-100 text-blue-800 p-2 rounded-full mr-3 flex-shrink-0">
                                <i class="fas fa-sync-alt"></i>
                            </div>
                            <div>
                                <h3 class="font-bold text-lg mb-2">定期审查规则</h3>
                                <p class="text-gray-600">IP地址可能会变化，定期审查ACL规则确保它们仍然符合当前需求，移除不再需要的规则。</p>
                            </div>
                        </div>
                    </div>

                    <div class="bg-white rounded-lg p-6 shadow-sm">
                        <div class="flex items-start mb-3">
                            <div class="bg-purple-100 text-purple-800 p-2 rounded-full mr-3 flex-shrink-0">
                                <i class="fas fa-shield-alt"></i>
                            </div>
                            <div>
                                <h3 class="font-bold text-lg mb-2">结合其他安全措施</h3>
                                <p class="text-gray-600">ACL是安全策略的一部分，应与其他措施如HTTPS、认证、防火墙等结合使用。</p>
                            </div>
                        </div>
                    </div>
                </div>
            </div>
        </section>
    </main>

    <!-- Footer -->
    <footer class="bg-gray-900 text-gray-300 py-8">
        <div class="container mx-auto max-w-6xl px-4">
            <div class="flex flex-col md:flex-row justify-between items-center">
                <div class="mb-4 md:mb-0">
                    <h3 class="text-xl font-bold text-white mb-2">技术小馆</h3>
                    <p class="text-sm">专注分享实用的技术知识</p>
                </div>
                <div>
                    <a href="http://www.yuque.com/jtostring" class="text-blue-400 hover:text-blue-300 transition duration-300 flex items-center">
                        <i class="fas fa-external-link-alt mr-2"></i> www.yuque.com/jtostring
                    </a>
                </div>
            </div>
            <div class="border-t border-gray-700 mt-6 pt-6 text-sm text-center text-gray-500">
                &copy; 2023 技术小馆. 保留所有权利.
            </div>
        </div>
    </footer>

    <script>
        // Initialize Mermaid
        mermaid.initialize({
            startOnLoad: true,
            theme: 'dark',
            flowchart: {
                useMaxWidth: false,
                htmlLabels: true,
                curve: 'basis'
            }
        });
    </script>
</body>
</html>
```